Add create-time sandbox egress controls

[arslnb]

Summary

• adds create-time sandbox egress policy parsing, validation, persistence, API response surfacing, and fork inheritance
• enforces Firecracker host egress policies with per-sandbox nftables rules and controlled DNS for domain policies
• normalizes deployment nftables/systemd configuration and documents the egress model
• adds SDK helpers and README/API/feature examples for the full feature surface

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• npm run build (sdk/typescript)
• npm pack --dry-run (sdk/typescript)
• python -m build (sdk/python)
• npm run typecheck (workdir-client)

Notes

• Local macOS cannot run nftables syntax validation; nft enforcement will be validated on the EX44 Linux host before marking deployment complete.
• Live network smoke tests require the Firecracker runtime and are run via wkdir-test with WORKDIR_RUN_NETWORK_TESTS=1 after deploy.